What vzdump does well — and its ceiling
vzdump takes a complete image of a guest and writes it as one archive to any storage PVE can reach. Zero extra infrastructure, trivially portable — copy the file anywhere, restore it on any PVE host. For a couple of small VMs and short retention, it's honestly fine.
Its ceiling is structural: every backup is a full backup. A 200GB VM backed up nightly writes 200GB (pre-compression) every night, whether 200MB or nothing changed. Retention multiplies it, the backup window stretches with it, and pushing nightly fulls offsite over an internet uplink stops being realistic long before the NAS fills.
The storage math
Same workload, 30 days of nightly retention: ten VMs, 2TB total, ~2% daily change.
- vzdump: 30 nightly fulls × 2TB ≈ 60TB before compression; maybe 30–40TB after. Most shops respond by cutting retention to a week and hoping.
- PBS: one 2TB baseline plus ~40GB of new deduplicated, compressed chunks per night — 30 days lands around 3–4TB. Dirty-bitmap tracking means the nightly job reads only changed blocks, so the backup window shrinks from hours to minutes as well.
A 10× storage difference at 30 days — and it widens as retention grows, which is why months of history is a normal PBS policy and an absurd vzdump one. On our Dynamic plan, which bills on compressed stored size, that difference is your bill.
Restores: the whole image or one file
vzdump restores are all-or-nothing: to recover one deleted config file you restore the entire archive somewhere and go spelunking. PBS mounts any snapshot read-only in the PVE UI — File Restore — and you download exactly the file you need. For whole guests, PBS adds live restore: the VM boots while its data streams in the background, turning recovery time from "when the copy finishes" into minutes. And because snapshots share chunks, keeping 30 restore points costs little more than keeping 3.
Verification and encryption
A vzdump archive is verified the day you restore it — which is the wrong day to learn it's corrupt. PBS re-reads and re-checksums snapshots on a schedule, flagging silent corruption while good copies still exist. It also does client-side AES-256 encryption where you hold the key — chunks are encrypted before they leave your host, which is what makes handing the storage to someone else (us included) a reasonable thing to do.
Making the switch
PBS is free software, and self-hosting it on decent hardware is a fine path — our setup guide covers it. The catch is it wants its own machine, its own disks, and ongoing care — and if it lives next to your cluster, you still need an offsite leg.
The shortcut: point PVE at a hosted PBS and get the incremental-dedup engine, file restore, and the offsite copy in one move — about five minutes on Dynamic, no hardware purchase involved. Keep vzdump for what it's still good at: the occasional portable one-file export before risky maintenance.
The PBS upgrade, without the server.
Incremental, deduplicated, offsite — from $6.95/month with the first 1TB included.